I am designing a resource request system where an user can request resource of different types. There can be many resource types such as:

  1. VM
  2. DB
  3. File System
  4. etc

Above types can have sub-types and i.e. there can be mysql, postgresql etc for resource type of DB. The user can have different roles like:

  1. Director
  2. Manager
  3. Employee

Use Cases

A director can request any resource on behalf of any manager and its cost centre.

A manager can request any resource oh behalf of any of his cost centres.

An employee can request only those resource which is allowed by his manager.


For director is very easy since there is no check in the system. For manager and user I have a many to many relationship between resource type and user entity


I see that the system needs Roles and Permissions but by using these I can establish some generic rules such as the user assigned the Reporting role can see the reports, but how to manage more granular level of permissions like a given user can only request only a given resource?

  • This question is also germane, about role-based versus permission-based approaches -- softwareengineering.stackexchange.com/questions/299729/…
    – neontapir
    Dec 14, 2017 at 20:20
  • There's already a standard and framework that does just what you're looking for: attribute based access control (ABAC). There are many libraries that implement it and its underlying policy language (XACML) Dec 17, 2017 at 0:06

1 Answer 1


The right move here is to separate the two concepts. You have roles with a list of permissions, and then you have a sort of whitelist implementation where a given user can only access specific resource or resource types.

So first step, define a list of permissions, which is to say, all the possible things a user could be able to accomplish. In your specific case, I think these would suffice:

  1. Can request resource on behalf of Manager.
  2. Can request resource on behalf of his cost centre.
  3. Can request resources allowed by whitelist.
  4. Can request any resource.

Your director role would have 1, 2, and 4. You could possibly add 3 as well so long as you first check existence of 4 (in other words if written properly, you should never lose functionality in your program by adding a permission).

Your manager role would just have 2 and 4. Your employee role would have, you guessed it, just 3.

So what happens when you get a role with no permissions? A role with no permissions is the maximum allowable features you allow for someone with no authorization (aka a guest) and it is correct that this is the default behavior from a security standpoint.

Right, now you have permissions. Now all you have to do is implement the whitelist. The whitelist just guarantees that a given employee can access a given resource. Forget permissions for a second and focus on this simple task.

Once you have both, you need only add a switch in your code to change behavior like:

If user has permission 4:
   return getResource(resource)
Else if user has permission 3 and hasAccess(user, resource):
   return getResource(resource)
   throw new ResourceInaccessibleException();

The trick is just making a distinction between permission and checks performed with or without said permissions. Using a role/permission pattern like this is also very flexible for you in the future.

  • So, I need to implement some whitelisting too apart from the existing roles and permissions.
    – CodeYogi
    Dec 14, 2017 at 12:33
  • @CodeYogi Yes, I would definitely advise to separate the two in your program. They're related, but they need not be highly coupled. You're simply using permissions to change the behavior of the program, and using roles to organize these permissions.
    – Neil
    Dec 14, 2017 at 13:13
  • yes, but you mentioned I need a third thing called whitelisting
    – CodeYogi
    Dec 14, 2017 at 13:54
  • An alternative to including a switch statement in each section of code is to push that check into objects that handle authorization. This article discusses a couple of approaches: lostechies.com/derickbailey/2011/05/24/…. Though .NET specific, the ideas port to other languages.
    – neontapir
    Dec 14, 2017 at 20:08
  • @CodeYogi By whitelisting, I mean checking that you find that exact user and resource on a predefined list. If it isn't on the list, you consider it an invalid request. The term derived from the opposite of blacklisting, which is to say, to consider a request invalid if something is on the list.
    – Neil
    Dec 15, 2017 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.